Changeset 86119 in vbox for trunk/src/VBox

Timestamp:

Sep 14, 2020 9:15:29 AM (4 years ago)

Author:

vboxsync

Message:

AMD IOMMU: bugref:9654 Bits.

File:

• trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp (modified) (6 diffs)

trunk/src/VBox/Devices/Bus/DevIommuAmd.cpp

@@ -2468 +2468 @@
                             IOMMUOP enmOp, PIRTE_T pIrte)
 {
+    /* Ensure the IRTE length is valid. */
+    Assert(pDte->n.u4IntrTableLength < IOMMU_DTE_INTR_TAB_LEN_MAX);
+
     RTGCPHYS const GCPhysIntrTable = pDte->au64[2] & IOMMU_DTE_IRTE_ROOT_PTR_MASK;
+    uint16_t const cbIntrTable     = IOMMU_GET_INTR_TAB_LEN(pDte);
     uint16_t const offIrte         = (uDataIn & IOMMU_MSI_DATA_IRTE_OFFSET_MASK) << IOMMU_IRTE_SIZE_SHIFT;
     RTGCPHYS const GCPhysIrte      = GCPhysIntrTable + offIrte;
 
-    /* Ensure the IRTE offset is within the specified table size. */
-    Assert(pDte->n.u4IntrTableLength < 12);
-    if (offIrte + sizeof(IRTE_T) <= (1U << pDte->n.u4IntrTableLength) << IOMMU_IRTE_SIZE_SHIFT)
+    /* Ensure the IRTE falls completely within the interrupt table. */
+    if (offIrte + sizeof(IRTE_T) <= cbIntrTable)
     { /* likely */ }
     else
     {
+        LogFunc(("IRTE exceeds table length (GCPhysIntrTable=%#RGp cbIntrTable=%u offIrte=%#x uDataIn=%#x) -> IOPF\n",
+                 GCPhysIntrTable, cbIntrTable, offIrte, uDataIn));
+
         EVT_IO_PAGE_FAULT_T EvtIoPageFault;
         iommuAmdInitIoPageFaultEvent(uDevId, pDte->n.u16DomainId, GCPhysIn, false /* fPresent */, false /* fRsvdNotZero */,
@@ -2657 +2663 @@
                         {
                             /* Validate the encoded interrupt table length when IntCtl specifies remapping. */
-                            uint32_t const uIntTabLen = Dte.n.u4IntrTableLength;
-                            if (Dte.n.u4IntrTableLength < 12)
+                            uint8_t const uIntrTabLen = Dte.n.u4IntrTableLength;
+                            if (uIntrTabLen < IOMMU_DTE_INTR_TAB_LEN_MAX)
                             {
                                 /*
@@ -2674 +2680 @@
                             }
 
-                            LogFunc(("Invalid interrupt table length %#x -> Illegal DTE\n", uIntTabLen));
+                            LogFunc(("Invalid interrupt table length %#x -> Illegal DTE\n", uIntrTabLen));
                             EVT_ILLEGAL_DTE_T Event;
                             iommuAmdInitIllegalDteEvent(uDevId, pMsiIn->Addr.u64, false /* fRsvdNotZero */, enmOp, &Event);
@@ -3198 +3204 @@
         {
             pHlp->pfnPrintf(pHlp, "    Size                                    = %#x (%u bytes)\n", DevTabBar.n.u9Size,
-                            IOMMU_GET_DEV_TAB_LEN(DevTabBar));
+                            IOMMU_GET_DEV_TAB_LEN(&DevTabBar));
             pHlp->pfnPrintf(pHlp, "    Base address                            = %#RX64\n", DevTabBar.n.u40Base << X86_PAGE_4K_SHIFT);
         }
@@ -3775 +3781 @@
 
     pHlp->pfnPrintf(pHlp, "%sInterrupt Map Valid        = %RTbool\n", pszPrefix, pDte->n.u1IntrMapValid);
-    if (pDte->n.u4IntrTableLength < 12)
-    {
-        uint32_t const cEntries = 1U << pDte->n.u4IntrTableLength;
-        pHlp->pfnPrintf(pHlp, "%sInterrupt Table Length     = %#x (%u entries, %u bytes)\n", pszPrefix,
-                        pDte->n.u4IntrTableLength, cEntries, cEntries << IOMMU_IRTE_SIZE_SHIFT);
+    uint8_t const uIntrTabLen = pDte->n.u4IntrTableLength;
+    if (uIntrTabLen < IOMMU_DTE_INTR_TAB_LEN_MAX)
+    {
+        uint16_t const cEntries    = IOMMU_GET_INTR_TAB_ENTRIES(pDte);
+        uint16_t const cbIntrTable = IOMMU_GET_INTR_TAB_LEN(pDte);
+        pHlp->pfnPrintf(pHlp, "%sInterrupt Table Length     = %#x (%u entries, %u bytes)\n", pszPrefix, uIntrTabLen, cEntries,
+                        cbIntrTable);
     }
     else
-        pHlp->pfnPrintf(pHlp, "%sInterrupt Table Length     = %#x (invalid)\n", pszPrefix, pDte->n.u4IntrTableLength);
+        pHlp->pfnPrintf(pHlp, "%sInterrupt Table Length     = %#x (invalid!)\n", pszPrefix, uIntrTabLen);
     pHlp->pfnPrintf(pHlp, "%sIgnore Unmapped Interrupts = %RTbool\n", pszPrefix, pDte->n.u1IgnoreUnmappedIntrs);
     pHlp->pfnPrintf(pHlp, "%sInterrupt Table Root Ptr   = %#RX64 (addr=%#RGp)\n", pszPrefix,
@@ -3863 +3871 @@
         if (GCPhysDevTab)
         {
-            uint32_t const cbDevTab = IOMMU_GET_DEV_TAB_LEN(DevTabBar);
+            uint32_t const cbDevTab = IOMMU_GET_DEV_TAB_LEN(&DevTabBar);
             uint32_t const cDtes    = cbDevTab / sizeof(DTE_T);
             pHlp->pfnPrintf(pHlp, " Table %u (base=%#RGp size=%u bytes entries=%u):\n", i, GCPhysDevTab, cbDevTab, cDtes);